@mcp-abap-adt/connection 5.0.0 → 6.0.1

package/dist/connection/KerberosAbapConnection.js

@@ -1,128 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.KerberosAbapConnection = void 0;
-const axios_1 = require("axios");
-const kerberosSpnego_js_1 = require("../auth/kerberosSpnego.js");
-const ntlm_js_1 = require("../auth/ntlm.js");
-const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `a Kerberos credential`:
- *
- *   not yet available — SPNEGO keeps its own class until its exchange is moved
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-class KerberosAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
-    spn;
-    currentToken = '';
-    constructor(config, logger, sessionId) {
-        KerberosAbapConnection.validateConfig(config);
-        super(config, logger || null, sessionId);
-        this.spn =
-            config.kerberosSpn ??
-                `${config.kerberosService ?? 'HTTP'}@${new URL(config.url).hostname}`;
-    }
-    static validateConfig(config) {
-        if (config.authType !== 'kerberos') {
-            throw new Error(`Kerberos connection expects authType "kerberos", got "${config.authType}"`);
-        }
-        if (config.connectionType === 'rfc') {
-            throw new Error('Kerberos auth is not supported with connectionType "rfc".');
-        }
-    }
-    /** Generate the SPNEGO token once (single-leg). */
-    async ensureToken() {
-        if (!this.currentToken)
-            this.currentToken = await (0, kerberosSpnego_js_1.generateSpnegoToken)(this.spn);
-    }
-    /**
-     * Generates the SPNEGO token and primes the session. MUST be called before the first
-     * request — the first request carries the Negotiate header; SAP then issues a session
-     * cookie which is reused for subsequent requests.
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    async establishSession() {
-        await this.ensureToken();
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
-        this.logger?.debug(`[DEBUG] KerberosAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
-        try {
-            // ONE attempt, deliberately — the shared default is 3 retries a second
-            // apart, and every one of them corrupts this exchange:
-            //
-            //  - A GSS token is one-shot. Replaying it is meaningless at best, and
-            //    replay protection may answer it differently than the original.
-            //  - Worse, a 401 that sets a cookie silences buildAuthorizationHeader()
-            //    (a cookie carries auth after the first round trip), so the retry
-            //    goes out with NO Authorization at all and draws the server's plain
-            //    opening challenge.
-            //
-            // Either way the classifier below would read the LAST response and name
-            // the wrong cause. The retry cannot help here anyway: nothing about a
-            // rejected token changes by waiting a second. Retrying a transient
-            // network failure is the caller's business now that connect() is
-            // explicit, and a fresh connect() mints a fresh token.
-            const token = await this.fetchCsrfToken(discoveryUrl, 0, 0);
-            this.setCsrfToken(token);
-        }
-        catch (error) {
-            // The token went out and was not accepted, so it is spent. Keeping it
-            // would make every later connect() replay a token already known to fail.
-            this.currentToken = '';
-            if (error instanceof axios_1.AxiosError && error.response?.headers) {
-                const wwwAuth = error.response.headers['www-authenticate'];
-                if ((0, ntlm_js_1.isNtlmChallenge)(wwwAuth)) {
-                    throw new Error('KerberosAbapConnection: server offered NTLM authentication, which is rejected. ' +
-                        'Only Kerberos/SPNEGO is supported. Ensure the SAP system accepts Kerberos (SPNEGO) for your user.');
-                }
-                if (this.getCookies()) {
-                    this.logger?.debug('[DEBUG] KerberosAbapConnection - cookies captured from error response during connect');
-                }
-                // A 401 carrying a Negotiate token is a CONTINUATION, not a success.
-                //
-                // Per RFC 4559 the server is handing back gssapi-data for the client to
-                // feed into its GSS context and retry. This client cannot do that:
-                // generateSpnegoToken() calls step('') once and discards the context,
-                // so there is nothing to continue with. The token it holds is the
-                // initial one, and sending it again produces the same 401.
-                //
-                // So this fails, and says why — resolving here would claim a readiness
-                // that does not exist and move the failure to the first real request,
-                // where it reads as an unrelated auth error.
-                if ((0, ntlm_js_1.isNegotiateContinuation)(wwwAuth)) {
-                    throw new Error('KerberosAbapConnection: the server continued the SPNEGO exchange ' +
-                        '(401 with a Negotiate token), which requires feeding that token ' +
-                        'back into the GSS context and retrying. This client performs a ' +
-                        'single-leg exchange only — the context is discarded after the ' +
-                        'first step — so multi-leg SPNEGO is not supported. See ' +
-                        'https://www.rfc-editor.org/rfc/rfc4559');
-                }
-                // A BARE Negotiate is a different problem with a different fix: the
-                // initial Authorization has already gone out, so an empty challenge is
-                // the server declining it. No token came back, so there is nothing to
-                // step even for a client that supports multi-leg.
-                if ((0, ntlm_js_1.isBareNegotiateChallenge)(wwwAuth)) {
-                    throw new Error('KerberosAbapConnection: the server rejected the SPNEGO token ' +
-                        '(401 with a bare Negotiate challenge, no token returned). The ' +
-                        'credentials were not accepted — check the SPN, the ticket ' +
-                        '(klist / kinit), and that the user is permitted Kerberos logon.');
-                }
-            }
-            throw error;
-        }
-    }
-    buildAuthorizationHeader() {
-        if (this.getCookies())
-            return ''; // cookie carries auth after first round-trip
-        if (!this.currentToken) {
-            throw new Error('KerberosAbapConnection: SPNEGO token not yet available. Call connect() before making requests.');
-        }
-        return `Negotiate ${this.currentToken}`;
-    }
-}
-exports.KerberosAbapConnection = KerberosAbapConnection;

package/dist/connection/RfcAbapConnection.d.ts

@@ -1,44 +0,0 @@
-import type { IAbapRequestOptions, IAdtResponse } from '@mcp-abap-adt/interfaces';
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import type { AbapConnection } from './AbapConnection.js';
-/**
- * RFC-based connection for on-premise SAP systems.
- *
- * Uses @mcp-abap-adt/sap-rfc-lite to call SADT_REST_RFC_ENDPOINT — the same standard SAP FM
- * that Eclipse ADT uses for all on-premise ADT operations via JCo.
- *
- * RFC connections are inherently stateful: one ABAP session persists for the
- * entire connection lifetime. This solves the HTTP 423 "invalid lock handle"
- * problem on legacy systems (BASIS < 7.50) where HTTP stateful sessions
- * are not supported.
- *
- * Connection parameters are derived from the standard ISapConfig.url field:
- *   http://saphost:8000 → ashost=saphost, sysnr=00
- *
- * Prerequisites:
- *   - SAP NW RFC SDK installed on the machine
- *   - @mcp-abap-adt/sap-rfc-lite package installed: npm install @mcp-abap-adt/sap-rfc-lite
- */
-export declare class RfcAbapConnection implements AbapConnection {
-    private readonly config;
-    private readonly logger;
-    private rfcClient;
-    private readonly sessionId;
-    private readonly baseUrl;
-    private readonly rfcParams;
-    private sessionType;
-    private sessionCookie;
-    constructor(config: SapConfig, logger?: ILogger | null);
-    connect(): Promise<void>;
-    getBaseUrl(): Promise<string>;
-    getSessionId(): string | null;
-    setSessionType(type: 'stateful' | 'stateless'): void;
-    makeAdtRequest<T = any, D = any>(options: IAbapRequestOptions): Promise<IAdtResponse<T, D>>;
-    /**
-     * Close the RFC connection and release the ABAP session.
-     */
-    close(): Promise<void>;
-    private static validateConfig;
-}
-//# sourceMappingURL=RfcAbapConnection.d.ts.map

package/dist/connection/RfcAbapConnection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RfcAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/RfcAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAkG1D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IASpD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,WAAW,CAAyC;IAC5D,OAAO,CAAC,aAAa,CAAuB;gBAGzB,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,OAAO,GAAG,IAAW;IAa1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA8BxB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAU9C,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IA8L9B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,OAAO,CAAC,MAAM,CAAC,cAAc;CAqB9B"}

package/dist/connection/RfcAbapConnection.js

@@ -1,324 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RfcAbapConnection = void 0;
-const node_crypto_1 = require("node:crypto");
-function rfcErrorMessage(e) {
-    if (e instanceof Error)
-        return e.message;
-    if (e && typeof e === 'object')
-        return JSON.stringify(e);
-    return String(e);
-}
-/**
- * Derive RFC connection parameters from ISapConfig.
- * Parses hostname from config.url, system number from port (80XX → XX).
- *
- * Examples:
- *   http://saphost:8000  → ashost=saphost, sysnr=00
- *   http://saphost:8001  → ashost=saphost, sysnr=01
- *   http://saphost:8042  → ashost=saphost, sysnr=42
- */
-function buildRfcParams(config) {
-    const parsed = new URL(config.url);
-    const port = Number.parseInt(parsed.port || '8000', 10);
-    // SAP HTTP port convention: 80XX where XX = system number.
-    // SAP_SYSNR env var overrides derivation for non-standard ports (e.g. 50400).
-    const derivedSysnr = String(port - 8000).padStart(2, '0');
-    const sysnr = process.env.SAP_SYSNR?.trim() || derivedSysnr;
-    return {
-        ashost: parsed.hostname,
-        sysnr,
-        client: config.client || '000',
-        user: config.username || '',
-        passwd: config.password || '',
-        lang: 'EN',
-    };
-}
-/**
- * Map ADT exception type names to HTTP status codes.
- * These are standard ADT exception types returned in `<exc:exception>` XML.
- */
-const EXCEPTION_STATUS_MAP = {
-    ExceptionResourceNotFound: { code: 404, text: 'Not Found' },
-    ExceptionResourceNoAuthorization: { code: 403, text: 'Forbidden' },
-    ExceptionResourceAlreadyExists: { code: 409, text: 'Conflict' },
-    ExceptionResourceLocked: { code: 423, text: 'Locked' },
-    ExceptionBadRequest: { code: 400, text: 'Bad Request' },
-    ExceptionNotSupported: { code: 501, text: 'Not Implemented' },
-    ExceptionConflict: { code: 409, text: 'Conflict' },
-};
-/**
- * Detect HTTP status from ADT exception XML in response body.
- * On some legacy systems, SADT_REST_RFC_ENDPOINT returns errors as XML
- * exceptions without setting proper HTTP status codes in STATUS_LINE.
- */
-function detectExceptionStatus(body) {
-    // Extract exception type: <exc:exception ... xmlns:exc="..."><exc:type>ExceptionName</exc:type>
-    const typeMatch = body.match(/<exc:type[^>]*>([^<]+)<\/exc:type>/);
-    if (typeMatch) {
-        const exType = typeMatch[1].trim();
-        const mapped = EXCEPTION_STATUS_MAP[exType];
-        if (mapped) {
-            return { statusCode: mapped.code, statusText: mapped.text };
-        }
-    }
-    // Unknown exception type — return 500 as generic server error
-    return { statusCode: 500, statusText: 'Internal Server Error' };
-}
-/**
- * RFC-based connection for on-premise SAP systems.
- *
- * Uses @mcp-abap-adt/sap-rfc-lite to call SADT_REST_RFC_ENDPOINT — the same standard SAP FM
- * that Eclipse ADT uses for all on-premise ADT operations via JCo.
- *
- * RFC connections are inherently stateful: one ABAP session persists for the
- * entire connection lifetime. This solves the HTTP 423 "invalid lock handle"
- * problem on legacy systems (BASIS < 7.50) where HTTP stateful sessions
- * are not supported.
- *
- * Connection parameters are derived from the standard ISapConfig.url field:
- *   http://saphost:8000 → ashost=saphost, sysnr=00
- *
- * Prerequisites:
- *   - SAP NW RFC SDK installed on the machine
- *   - @mcp-abap-adt/sap-rfc-lite package installed: npm install @mcp-abap-adt/sap-rfc-lite
- */
-class RfcAbapConnection {
-    config;
-    logger;
-    rfcClient = null;
-    sessionId;
-    baseUrl;
-    rfcParams;
-    sessionType = 'stateless';
-    sessionCookie = null;
-    constructor(config, logger = null) {
-        this.config = config;
-        this.logger = logger;
-        RfcAbapConnection.validateConfig(config);
-        this.sessionId = (0, node_crypto_1.randomUUID)();
-        this.baseUrl = config.url;
-        this.rfcParams = buildRfcParams(config);
-        this.logger?.debug(`RfcAbapConnection created for ${this.rfcParams.ashost}:${this.rfcParams.sysnr}, client ${this.rfcParams.client}`);
-    }
-    async connect() {
-        let Client;
-        try {
-            // Dynamic require — @mcp-abap-adt/sap-rfc-lite is NOT a declared dependency.
-            // Users who need RFC connections must install it manually:
-            //   npm install @mcp-abap-adt/sap-rfc-lite (+ SAP NW RFC SDK on the machine)
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const noderfc = require('@mcp-abap-adt/sap-rfc-lite');
-            Client = noderfc.Client;
-        }
-        catch (e) {
-            throw new Error('@mcp-abap-adt/sap-rfc-lite is not available. To use RFC connections, install SAP NW RFC SDK ' +
-                'and run: npm install @mcp-abap-adt/sap-rfc-lite. ' +
-                `Details: ${rfcErrorMessage(e)}`);
-        }
-        this.rfcClient = new Client(this.rfcParams);
-        try {
-            await this.rfcClient.open();
-            this.logger?.debug('RFC connection opened (stateful session)');
-        }
-        catch (e) {
-            this.rfcClient = null;
-            const msg = rfcErrorMessage(e);
-            this.logger?.error(`RFC connection failed: ${msg}`);
-            throw new Error(`Failed to open RFC connection: ${msg}`);
-        }
-    }
-    async getBaseUrl() {
-        return this.baseUrl;
-    }
-    getSessionId() {
-        return this.sessionId;
-    }
-    setSessionType(type) {
-        this.sessionType = type;
-        if (type === 'stateless') {
-            this.sessionCookie = null;
-            this.logger?.debug('RFC session type: stateless (cookie cleared)');
-        }
-        else {
-            this.logger?.debug('RFC session type: stateful (will capture cookies)');
-        }
-    }
-    async makeAdtRequest(options) {
-        if (!this.rfcClient?.alive) {
-            throw new Error('RFC connection is not open. Call connect() first.');
-        }
-        const method = options.method.toUpperCase();
-        // Encode query params into URI (axios does this automatically for HTTP,
-        // but RFC needs it done manually)
-        let uri = options.url;
-        if (options.params && typeof options.params === 'object') {
-            const entries = Object.entries(options.params).filter(([, v]) => v !== undefined && v !== null);
-            if (entries.length > 0) {
-                const qs = new URLSearchParams(entries.map(([k, v]) => [k, String(v)]));
-                uri += (uri.includes('?') ? '&' : '?') + qs.toString();
-            }
-        }
-        // Note: sap-client is NOT added to URI for RFC connections.
-        // The RFC session is already logged into the correct client
-        // (via the 'client' param in RFC connection). Adding sap-client
-        // to the URI can cause "object not found" on some systems.
-        // Build header fields
-        const headerFields = [];
-        if (options.headers) {
-            for (const [name, value] of Object.entries(options.headers)) {
-                headerFields.push({ NAME: name, VALUE: value });
-            }
-        }
-        // Inject session type header so SAP creates/maintains an ICM session
-        if (this.sessionType === 'stateful') {
-            headerFields.push({ NAME: 'x-sap-adt-sessiontype', VALUE: 'stateful' });
-        }
-        // Replay session cookie for stateful operations (cookie captured from LOCK response)
-        if (this.sessionCookie) {
-            const existingCookie = headerFields.find((h) => h.NAME.toLowerCase() === 'cookie');
-            if (!existingCookie) {
-                headerFields.push({ NAME: 'Cookie', VALUE: this.sessionCookie });
-            }
-        }
-        // Ensure Content-Type for body
-        const body = options.data !== undefined && options.data !== null
-            ? String(options.data)
-            : '';
-        if (body &&
-            !headerFields.some((h) => h.NAME.toLowerCase() === 'content-type')) {
-            headerFields.push({
-                NAME: 'Content-Type',
-                VALUE: 'text/plain; charset=utf-8',
-            });
-        }
-        this.logger?.debug(`RFC → ${method} ${uri}`);
-        this.logger?.debug(`RFC → headers: ${JSON.stringify(headerFields)}`);
-        if (body)
-            this.logger?.debug(`RFC → body: ${body}`);
-        try {
-            const result = await this.rfcClient.call('SADT_REST_RFC_ENDPOINT', {
-                REQUEST: {
-                    REQUEST_LINE: {
-                        METHOD: method,
-                        URI: uri,
-                        VERSION: 'HTTP/1.1',
-                    },
-                    HEADER_FIELDS: headerFields,
-                    MESSAGE_BODY: body ? Buffer.from(body, 'utf-8') : Buffer.alloc(0),
-                },
-            });
-            const resp = result.RESPONSE || result;
-            // Log raw RFC response structure for debugging
-            this.logger?.debug(`RFC raw response keys: ${Object.keys(resp).join(', ')}`);
-            if (resp.STATUS_LINE) {
-                this.logger?.debug(`RFC STATUS_LINE: ${JSON.stringify(resp.STATUS_LINE)}`);
-            }
-            // Parse status — RFC returns status in STATUS_LINE structure
-            // Field names: STATUS_CODE (not CODE), REASON_PHRASE (not REASON)
-            const rawCode = resp.STATUS_LINE?.STATUS_CODE || resp.STATUS_LINE?.CODE || 0;
-            let statusCode = typeof rawCode === 'string' ? Number.parseInt(rawCode, 10) : rawCode;
-            let statusText = resp.STATUS_LINE?.REASON_PHRASE || resp.STATUS_LINE?.REASON || '';
-            // Parse response body
-            const respBody = resp.MESSAGE_BODY
-                ? Buffer.isBuffer(resp.MESSAGE_BODY)
-                    ? resp.MESSAGE_BODY.toString('utf-8')
-                    : String(resp.MESSAGE_BODY)
-                : '';
-            // Parse response headers
-            const respHeaders = {};
-            const respHeaderFields = resp.HEADER_FIELDS || [];
-            for (const field of respHeaderFields) {
-                if (field.NAME && field.VALUE !== undefined) {
-                    respHeaders[field.NAME.toLowerCase()] = field.VALUE;
-                }
-            }
-            // Capture session cookie from LOCK/stateful responses for cookie replay
-            if (this.sessionType === 'stateful' && respHeaders['set-cookie']) {
-                const setCookieHeader = respHeaders['set-cookie'];
-                // Extract cookie name=value pairs (strip attributes like Path, Secure, etc.)
-                const cookies = Array.isArray(setCookieHeader)
-                    ? setCookieHeader
-                    : [setCookieHeader];
-                const cookieValues = cookies
-                    .map((c) => c.split(';')[0].trim())
-                    .filter(Boolean);
-                if (cookieValues.length > 0) {
-                    this.sessionCookie = cookieValues.join('; ');
-                    this.logger?.debug(`RFC: captured session cookie: ${this.sessionCookie}`);
-                }
-            }
-            // On some systems (e.g. BASIS < 7.50), SADT_REST_RFC_ENDPOINT does not
-            // populate STATUS_LINE, returning status 0. Detect errors from the
-            // response body: ADT exception XML indicates a failed request.
-            if (!statusCode && respBody.includes('<exc:exception')) {
-                const detected = detectExceptionStatus(respBody);
-                statusCode = detected.statusCode;
-                statusText = detected.statusText;
-                this.logger?.debug(`RFC: STATUS_LINE empty, detected ${statusCode} from exception XML`);
-            }
-            // Default to 200 OK only when no error was detected
-            if (!statusCode) {
-                statusCode = 200;
-                statusText = statusText || 'OK';
-            }
-            this.logger?.debug(`RFC ← ${statusCode} ${statusText} (${respBody.length} bytes)`);
-            this.logger?.debug(`RFC ← headers: ${JSON.stringify(respHeaders)}`);
-            if (respBody)
-                this.logger?.debug(`RFC ← body: ${respBody}`);
-            const response = {
-                data: respBody,
-                status: statusCode,
-                statusText,
-                headers: respHeaders,
-            };
-            // Throw for error status codes (matching HTTP/axios behavior)
-            if (statusCode >= 400) {
-                const error = new Error(`Request failed with status ${statusCode}: ${method} ${uri}`);
-                error.response = response;
-                throw error;
-            }
-            return response;
-        }
-        catch (e) {
-            // Re-throw our own errors (status >= 400)
-            if (e?.response) {
-                throw e;
-            }
-            // RFC-level error
-            const msg = rfcErrorMessage(e);
-            this.logger?.error(`RFC call failed: ${msg}`);
-            throw new Error(`RFC call to SADT_REST_RFC_ENDPOINT failed: ${msg}`);
-        }
-    }
-    /**
-     * Close the RFC connection and release the ABAP session.
-     */
-    async close() {
-        if (this.rfcClient) {
-            try {
-                await this.rfcClient.close();
-                this.logger?.debug('RFC connection closed');
-            }
-            catch (e) {
-                this.logger?.debug(`RFC close error: ${rfcErrorMessage(e)}`);
-            }
-            this.rfcClient = null;
-        }
-    }
-    static validateConfig(config) {
-        if (config.connectionType !== 'rfc') {
-            throw new Error(`RFC connection expects connectionType "rfc", got "${config.connectionType}"`);
-        }
-        if (!config.url) {
-            throw new Error('RFC connection requires url (hostname is parsed from it)');
-        }
-        if (!config.username || !config.password) {
-            throw new Error('RFC connection requires both username and password');
-        }
-        if (!config.client) {
-            throw new Error('RFC connection requires SAP client');
-        }
-    }
-}
-exports.RfcAbapConnection = RfcAbapConnection;

package/dist/connection/SamlAbapConnection.d.ts

@@ -1,31 +0,0 @@
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import { AbstractAbapConnection } from './AbstractAbapConnection.js';
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `SamlAuthProvider`:
- *
- *   new AdtOnPremConnector(config, new SamlAuthProvider(cookies), logger)
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-export declare class SamlAbapConnection extends AbstractAbapConnection {
-    private sessionCookies;
-    constructor(config: SapConfig, logger?: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
-    /**
-     * Connect to SAP system using existing session cookies
-     * Fetches CSRF token to establish session context
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    protected establishSession(): Promise<void>;
-    protected buildAuthorizationHeader(): string;
-    getAuthHeaders(): Promise<Record<string, string>>;
-    private static validateConfig;
-}
-//# sourceMappingURL=SamlAbapConnection.d.ts.map

package/dist/connection/SamlAbapConnection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SamlAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/SamlAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;IAC5D,OAAO,CAAC,cAAc,CAAS;gBAG7B,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAUzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAItC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQvD,OAAO,CAAC,MAAM,CAAC,cAAc;CAW9B"}

package/dist/connection/SamlAbapConnection.js

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SamlAbapConnection = void 0;
-const axios_1 = require("axios");
-const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `SamlAuthProvider`:
- *
- *   new AdtOnPremConnector(config, new SamlAuthProvider(cookies), logger)
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-class SamlAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
-    sessionCookies;
-    constructor(config, logger, sessionId, options) {
-        SamlAbapConnection.validateConfig(config);
-        super(config, logger || null, sessionId, options);
-        this.sessionCookies = config.sessionCookies || '';
-        if (this.sessionCookies) {
-            this.setInitialCookies(this.sessionCookies);
-        }
-    }
-    /**
-     * Connect to SAP system using existing session cookies
-     * Fetches CSRF token to establish session context
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    async establishSession() {
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
-        this.logger?.debug(`[DEBUG] SamlAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
-        try {
-            const token = await this.fetchCsrfToken(discoveryUrl);
-            this.setCsrfToken(token);
-            this.logger?.debug('Successfully connected to SAP system', {
-                hasCsrfToken: !!this.getCsrfToken(),
-                hasCookies: !!this.getCookies(),
-                cookieLength: this.getCookies()?.length || 0,
-            });
-        }
-        catch (error) {
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            this.logger?.warn(`[WARN] SamlAbapConnection - Could not connect to SAP system upfront: ${errorMsg}. Will retry on first request.`);
-            if (error instanceof axios_1.AxiosError && error.response?.headers) {
-                if (this.getCookies()) {
-                    this.logger?.debug(`[DEBUG] SamlAbapConnection - Cookies extracted from error response during connect (first 100 chars): ${this.getCookies()?.substring(0, 100)}...`);
-                }
-            }
-            // Rethrow: a resolved connect() must mean a usable session exists. This
-            // used to swallow and resolve anyway, deferring establishment to the
-            // first request — coherent only while that lazy path existed. Without it,
-            // swallowing would leave a connection that reports success, holds
-            // nothing, and refuses every request.
-            throw error;
-        }
-    }
-    buildAuthorizationHeader() {
-        return '';
-    }
-    async getAuthHeaders() {
-        const headers = await super.getAuthHeaders();
-        if (this.sessionCookies) {
-            headers.Cookie = this.sessionCookies;
-        }
-        return headers;
-    }
-    static validateConfig(config) {
-        if (config.authType !== 'saml') {
-            throw new Error(`SAML connection expects authType "saml", got "${config.authType}"`);
-        }
-        if (!config.sessionCookies) {
-            throw new Error('SAML authentication requires sessionCookies');
-        }
-    }
-}
-exports.SamlAbapConnection = SamlAbapConnection;

package/dist/connection/connectionFactory.d.ts

@@ -1,25 +0,0 @@
-import type { ICertificateMaterialLoader, ITokenRefresher } from '@mcp-abap-adt/interfaces';
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import type { AbapConnection } from './AbapConnection.js';
-/**
- * Builds the connection the caller asked for.
- *
- * **Say which system it is** with `options.system`, and that is what you get —
- * `'onprem'` or `'cloud'` — with the credential built from the config and
- * handed in as an auth provider. Nothing about the system is worked out here:
- * not from the credential, not from the host name, not by asking the server.
- *
- * Without it, the old behaviour: a connection chosen from `authType`, which is
- * the arrangement where the credential drags the session mechanism along with
- * it and gets one of them wrong. **Deprecated**, kept so existing callers keep
- * working, and warned about once per call so it is visible rather than
- * inherited by accident.
- */
-export declare function createAbapConnection(config: SapConfig, logger?: ILogger | null, sessionId?: string, tokenRefresher?: ITokenRefresher, options?: {
-    skipSessionType?: boolean;
-    certLoader?: ICertificateMaterialLoader;
-    /** Which system this is. Said by the caller; never inferred. */
-    system?: 'onprem' | 'cloud';
-}): AbapConnection;
-//# sourceMappingURL=connectionFactory.d.ts.map

package/dist/connection/connectionFactory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connectionFactory.d.ts","sourceRoot":"","sources":["../../src/connection/connectionFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmD1D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe,EAChC,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACxC,gEAAgE;IAChE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC7B,GACA,cAAc,CA2ChB"}